The methodology of neural network robustness verification could be divided into two categories: complete verifier and incomplete verifier [1]}. Complete verifier [2]}, [3]}, [4]}, [5]} which can get accurate robustness bounds, is time-consuming and only applies to ReLU-based networks. In contrast, incomplete verifier [6]}, [7]}, [8]} risks verification precision loss due to over-approximation but is more scalable and efficient. Thus, to evaluate the robustness of other types of CNNs, acceleration techniques, such as linear approximation [9]}, [10]}, [11]} or abstract interpretation [12]}, [13]} is necessary. As approximation technique inevitably introduces overestimation, certified lower bound is the key criterion to evaluate robustness verification methods' performances.
